CVE-2020-8623
Publication date 20 August 2020
Last updated 24 July 2024
Ubuntu priority
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| bind9 | 20.04 LTS focal |
Fixed 1:9.16.1-0ubuntu2.3
|
| 18.04 LTS bionic |
Fixed 1:9.11.3+dfsg-1ubuntu1.13
|
|
| 16.04 LTS xenial |
Fixed 1:9.10.3.dfsg.P4-8ubuntu1.17
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
alexmurray
Affects versions 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-4468-1
- Bind vulnerabilities
- 21 August 2020